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Fusion from the Inside 
Abstract 


¢ System design 


¢ Broad examination of System 


Fusion and WiRES-X components 


e What the components do and how 


they interact 
¢ Public information 
°* Reverse Engineering 


¢ Hams -— How we can build on 


System Fusion for the future 
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Fusion System Design 


¢ Fit current FM spectral mask 
— Transition from FM to digital 

¢ Use established standards — P25/C4FM 
— And modify for Amateur Radio 


¢ User, Access Point, and Network layers 


Fusion Subsystems 


¢ Fusion / C4FM (Built on P25) 
— RF segment 

¢ WiIRES-X (Built on WIRES and WiRES II) 
— Networking segment 


— Nodes (Access Point) 


¢ Simplex access or remote repeater access 


— Repeaters (Access Point) 
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Popularity of Digital Voice 


Fusion 1,531 


Dstar 1,137 


DMR 1,189 


P25 254 


Data from RepeaterBook.com retrieved 13-Sep-2017 
Fusion may support FM and digital to various degrees 


Fusion Subsystem 


Published Standard 


Amateur Radio Digital Standards 


Amateur Radio Digital Standards 


January 15, 2013 Version 1.0 
July 29, 2015 Revision 1.02 


YAESU MUSEN CO., LTD. 


Control Unit 


Radio Station | 


Control Unit 


Relay Station 


Figure 2-1 System Composition and Scope of Application of these Specifications 


OTA Modes and Bandwidth 


Four modes of operation: 


2,450 1,150 3,600 
DN2 2,450 1,150+1,800 1,800 
VW 4,400 2,800 


Table 3-1 C4FM Mapping 


Deviations(Narrow 
+450 Hz 

+2700 Hz +1350 Hz 

-900 Hz -450 Hz 

-2700 Hz -1350 Hz 


OTA Protocol DN Modes 


Frame 


HC (Header) TC (Terminator) 
FN=O FN=1 


« 100 msec (960 bit) - « 100 msec (960 bit) -» ‘ 100 msec (960 bit) -» + 100 msec (960 bit) « 100 msec (960 bit) 
i ' 
Figure 4-6 Frame Composition Drawing 


DN1 3,600bps Data 


FICH OCH (0) VCH (0) VCH (1) DCH (2) VCH (2) VCH (3) DCH (4) VCH (4) | Number 
McacatlM Bou a ——— of bits 
72 72 72 72 Total 960 bit 


Figure -8 CC Structural Drawing 


DCH VeCH DCH VeCH VeCH DCH 


Number of bits 
(1) VCH (1) {1) (2) VCH (2) (2) VCH (3) (3) 


Total 960 bit 
Figure 4-12 CC Structural Drawing 


OTA Protocol VW and DW 


VCH (4) 
144 Number of bits 
Total 960 bit 


VCH (0) VCH (2) VCH (3) VCH (4) Number of bits 
144 144 144 144 Total 960 bit 
Figure 4-22 CC Structural Drawing 


FICH DCH-1(0) | OCH-2(0) | DCH4(1) | DCH-2(1) | DCH-1(2) | DCH-2(2) | DOH-1(3) | DCH-2(3) | DCH-1(4) | OCH-2(4) | Number of bits 
200 72 72 72 72 72 72 72 72 72 72 Total 960 bit 


Figure 4-15 CC Structural Drawing 


Note: No FEC on data and no ARQ 


Examine OTA Data 


Use a receiver to demodulate data 
Use software to process the signal 
Example 

— DV4mini 

— DV4RX — Github G4KLX/DV4RX 


— Build with VS 2017 Community 


WIRES-X 


vane 


6500 
—- 


WiRES-X Node Interface 


WireShark Network Captures 


Source Destination Protocol 


10.8.0.6 
180.42.3.130 


Time 
1 0.000000 
2 0.341234 
3 @.449945 


180.42.3.130 UDP 
16.8.0.6 UDP 
180.42.3.130 UDP 


Ethernet II, Src: 00:ff:82:09:1f:6c (@0:ff:82:09:1f:6c), Dst: 00:ff:83:09:1f:6c (00:ff: 


Internet Protocol Version 4, Src: 10.8.0.6, Dst: 180.42.3.130 
User Datagram Protocol, Src Port: 46100, Dst Port: 49690 
Data (81 bytes) 


Q00A05 
M2405750 308 
WO217050 40702602 
@0090C00 01121100 
11160500 416 


Q@80104IL S6080200 
@20D114. 191.3.19 
80309CB— JHIDPCOA 
@5121246 4@6JH1DP 
C@611Sak ura-city 
,Chiba@7 @5Japan@ 


List server request and update 


S1E...[. 
osQaee 


Length Info 
123 46100 + 49690 Len=81 
1176 496980 + 4610@ Len=1134 


B2313430 
DSQ:118, 
425MHz,D 
530Lat:N 
54" / Lo 
10° 51" 

m /2B020 
080990C880 
Q@3800FE8 
24.26.31 
JIP7BYD-N 
258406)P 
Sakata=c 
gata@765 
02313430 


:09:1f:6c) 


. 740MHz, 
2413466. 
SQ:O0FF,2 
:35 42' 

n:E:14@ 

/ R:001k 
02084000 
11221001 
200620D1 
. 2030309 
D@AG5121 
7BYD@614 
ity,Yama 
Japanese 
. 760MHz, 


aaEss sik pane 
Bananas -CPaa00030 
BO2118309N@8ANC-B 
RGBAG51838301012 
D2810D301804816D 
5016D6010D70200D 


AKSEQ/CHRISDCOA 

DOBANBA 
NC DEBS 
DFOS1TBSR3FA852714 
SSE1Q5E540DE3026 
BE4042 702Ce1E5F2 
6543550573156792 
FT FECZB1LC2ZBEBRCT 
ea lai nana 

»610.F. a 


Capture: DMR Not morking 


-CPR080030 
BO2110309NGANC- B 
RGBAGS1ES83D18012 
D26018036018D460180 
58160681007 6280D 
FA he he he abe he abe oe ake he ke [1 BB 
AABS3GD DCBA 

COBANBA 
NC DE@5 


93E105 E3023 
BE4O42201CeB45F2 


WiRES-X Ports 


¢ Ports forwarded to node/room Port | Purpose Destination 


* Each node is a server Yaesu List Server 49,690 
* Every user can create their own 


Node control 46,110 46,120 


Room/reflector 
Node voice 


e List Server coordinates 

connections Room control 
Room voice 

News control 


Web access 


ion 4, Src: 580.207.102.150, Dst: 10.8.0.6 
Src Port: 46122, Dst Port: 46110 Src: 50.207.102.15@, Dst: 10.8.0.6 


ff 83 09 1f 6c 08 0@ 45 @@......1.. 1. oi Port: 46122, Dst Port: 46112 


11 17 e5 32 cf 66 96 8a 08 e@oU.aUe sadstonn 83 09 1f 6c @8 @@ 45 a8 
2c 34 33 43 5@ 30 30 30 30 ‘ , 43CP8000 d9 ac 32 cf 66 96 @a @8 
30 32 30 39 30 41 30 30 33 Q@33000B8 2098A003 b@ cc 43 4f 

Bp 33 32 42 30 32 30 30 70521493 2B0200 


Voice Data Capture 


6.644078 50.207.102.150 10.8.0.6 Len=27 
6.738918 10.8.0.6 50.207.102.150 Len=152 
6.768873 50@.207.102.150 Len=152 
6.858878 50.207.102.150 Len=152 
6.909074 180.42.3.130 123 Len=81 
6.948860 500.207.102.150 194 Len=152 
7.018842 Len=152 

Frame 62: 194 bytes on wire (1552 bits), 

Ethernet II, Src: 00:ff:82:09:1f:6c (00:ff:82:09:1f:6c), Dst: 00:ff:83:09:1f:6c (00: ff:83:09:1f:6c) 

Internet Protocol Version 4, Src: 10.8.0.6, Dst: 50.207.102.150 

User Datagram Protocol, Src Port: 46116, Dst Port: 46120 

Data (152 bytes) 


0008 00 ff 
0019 00 b4 
0020 66 


Frame 


WIRES-X Startup — List Server 


Load binary configuration file from fixed URL 


Configuration points to multiple List Servers 


11. 876894 
11.958547 
11.958809 
11. 960366 
12.042547 
12.042788 


Source 


192.168.3.126 
71.139.254.252 
192.168.3.126 
192.168.3.126 
71.139.254.252 
192.168.3.126 


711.139.254.252 
192.168.3.126 
71.139.254.252 
71.139.254.252 
192.168.3.126 
71.139.254.252 


Protocol Length 
TCP 66 
TCP 66 
TCP 54 


HTTP 752 
TCP 54 


Info 

52022 + 8@ [SYN] Seq=@ Win=8192 Len=@ MSS=146@ WS=4 SACK_PERM=1 

8@ + 52022 [SYN, ACK] Seq=@ Ack=1 Win=8192 Len=@ MSS=1380 WS=256 SACK_PERM=1 
52022 + 8@ [ACK] Seq=1 Ack=1 Win=6624@ Len=0 

GET /jp/en/wiresinfo—en/sv/UpdateInfo.bin HTTP/1.1 

HTTP/1.1 200 OK (application/octet-stream) 

52022 + 8@ [ACK] Seq=122 Ack=699 Win=6554@ Len=0 


73: 175 bytes on wire (140@ bits), 175 bytes captured (140@ bits) on interface @ 
Ethernet II, Src: GoodWayI_16:dc:77 (@0:50:b6:16:dc:77), Dst: 
Internet Protocol Version 4, Src: 


Apple_29:12:a9 (88:1f:a1:29:12:a9) 
192.168.3.126, Dst: 71.139.254.252 


Transmission Control Protocol, Src Port: 52022, Dst Port: 80, Seq: 1, Ack: 1, Len: 121 


0000 


88 1f 


0010 0@ al 


0020 


fe fc 


12 
40 
4) 


16 
6c 


»P 


oo We oe 


—E T /jp/en 


/wiresin 
/Updatel 
HTTP/1.1 
gent: WI 
ost: www 
om. .Cach 
l: no-ca 


fo-en/sv 
nfo.bin 

..User-A 
RES-X..H 
-yaesu.c 
e-Contro 
che.... 


WIiIRES-X Data 


List Server Hello TCP to fixed URL 


List Server initial response List of resources (servers), configuration 


List Server Request Connection to List Server 
List Server Responses Rooms, Nodes, descriptions, IP address 
Status Update Node, Room and List Server 


Heartbeat Periodic, still alive 
Heartbeat response Reverse heartbeat 
Control information Tx up/down, connect request, disconnect, etc. 


Voice Analog and Fusion OTA data 


WiIRES-X Console 


[act | calveim.. | ciy | State Cor 
1 ABIDW-ND g F 
1 KAICNF-ND \ 
1D KA4YMZ-RPT 5h cad North C... 
A KBOGRP-ND Nebra 
Neue : oe. New'iite el U2PSR-MATT > ****8*4%%% (DN: FTM-400D) 
QNSA-RPT 11: . <CONSA _Raundlake _lllinnis __USs_ sole jee) 


Roon MNWIS-FUSION(21493) member 39 nodes 


Fr. n Wisco! US: 


F4HR-NC 
ZULEfUYSLS Lirbs: DLYUH-ND(L4//5) LN. 4U Nodes. 


—_ 
aan Cou. | Freqa]| 2027/09/13 11:55:29 DL9OH-ND(17775) OUT. 39 Nodes. 
KOSTP 


2017/09/13 ooo List Create Group window list {XML} 
Gordonsville Virginia = USA 443. 2017/09/13 11:55: List Create Active ID list (XML) 
2E0FTG Hook Hamps.. UK 2017/09/13 oes List Create Room ID list (XML) 
JEIUDL 3 <i-ci Gunma Jap.. 2017/09/13 202: W6DEN-ND (30609) OUT. 38 Nodes. 
BJUB Ke Hokkaido Jap... 430. »{ 2017/09/13 12:03: WEDEN-ND (30609) IN. 39 Nodes. 
» 


Ci State_* 


@Barwe CQ-ROOM 161 ALLJA CQ ROOMH1 = Yamato-cit Kanagé 2017/03/ 0 WOMDT -H MNWIS-FUSION : I hate Cent ink! [EOM] ...d 
? eas : : sme 9/ 22 WOMDT-MVY S MNWIS-FUSION : There eel better. 
-LINK 2108 America Link 


27003 046 ‘WIRES-XITALIA 
21493 


20382 
20587 
20435 M-Fh = ak * Gunme 
29158 5 OIE ] tabas Tokyo 
AND 27784 j POLAND-room é 
@ E-KYUSHU-ROOM 18 “( Room 


PRITALY KIODM ITALY KIADM 


WiIRES-X Software Data 


WIRES-X Nodes Connected to MNWIS de K9EQ 


WiRES-X Room #21493 


XMIL/CSV Data 
— All Nodes* 


freq «Oommen SY 


145.230MHz-.600MHz /TSQ: 230 CHASKA MN PL 114.8 
— Group ID* we 
p : lsesssomniesooomma[peso | SSCSCS@d 


— All Rooms* 


Dale - Franklin, Wi, USA 
= 
Logs : ork a 
MNWIS Stations Last Heard de K9EQ 
WiRES-X Room #21493, Updated about e' 30 minutes 
ax N @) d e 7 Sorted by date/time when the indicated si r ID was heard. 
Stations on WOMDT-MV 444 as Local 
Courte: if Python=0.9.3 
Roo m see Do not bookmark this page - it will change. Use Ha convFusion/WiRES-X 
FT1D=12. FT2D=8. FTM-400=40. FTM- 100=19. FTM-3200=2. FT70D=3. FT-991=6. Total=90 
— a STATION CALL Radio Type [Net or Local [When Heard 
— News : WOMTA-MYKL _|WOMTA-MYKL Local Wed Sep 13 18:00:55 2017 
Acne coer rip sa Wed Sep 13 18:00:28 2017 
K9EQ/R-075 K9EQUR-075 Wed Sep 13 18:00:09 2017 
Ot al er : N9GHP/MIKE Se a ee a ad 13 17:51:25 2017 


NXPO-MIKE—[NIXPOMIRE ppt —fFTWea00 Net" We Sep 13 1748:362017 
eee ae prov. SRL 4a Net Weep 1892207 
— Access Log (all transmissions) 


INOIOL-JOE _|NOJOLJOE ____[Fo6la__|FTM-400__[Net____|Wed Sep 13 16:52:36 2017 _ 

— Diagnostic 
Used b ee laale) erator. com INIJUX/IKEVN _|NIJUX/KEVN [F54kT |FTM-100 [Net —_[ Wed Sep 13 16:34:22 2017 
y p : INOIOLIOE —_|NOJOLJOE | _———~|_—_—_—(ocal___|Wed Sep 13 16:30:00 2017 


_— [SS Sy SS SSS 


Analysis Tools 
¢ WireShark “4 


— Wireshark.org 
— FTDIChip.com 


¢ Scanastudio 


— IKALogic.com 


¢ Oscilloscope 


TAPR and Manufacturers 
Discussion 


Could TAPR collaborate with manufacturers on projects? 
What should manufacturers do? What should Hams do? 


Is there opportunity to bring digital benefits to a broad range of 
non-technical users? (l.e., APRS) 
What Digital Voice needs to do (hint: things analog can’t do) 
Potential Projects: 

— Diversity reception for repeaters 

— Multisite digital reception 


— Common receive locations for multiple repeaters 


Additional Resources 


Saelig.com — Test Equipment 

SparkFun.com, Adafruit.com, Hacktronics.com, SeeedStudio.com 
Hackaday.com, DIYHacking.com 

Element14.com 

Tapr.org 

Yaesu Digital Standard (Yaesu.com) 

Github software repositories 


Fusion Technical Net Monday 7:30 PM Central (0030/0130 UTC) Room #21493, 


Internet Streaming: HamOperator.com 


73, Chris K9EQ 


